Recovering an Orphan OST File

Googling for 'convert ost pst' turned up a handful of ~$600 utilities which promised to do the job. The search also turned up a $75 utility called "Recovery Toolbox for Outlook" which turns out to be a winner.

www.recoverytoolbox.com

It has some limitations, most notably that it cannot output pst files greater than 1GB. The workaround for a multi-GB OST or PST file input is to save the output as multiple 1GB PST files.

My OST file was only 174MB, but the recovery to PST file took about 3.5 hours, during which time Task Manager showed Outlook.exe continuously at ~45% of CPU and RecoveryToolboxForOutlook.exe at ~15% CPU. I suspect that this utility relies on Outlook to do much of its work.

While the processing is going on, there's a progress bar and counter for items recovered. The bar moved quickly at the beginning but very slooooowly toward the end. The last 500 of the 5000 total items were taking about 15 seconds each to process. The machine was a 2.8GHz P4 with 1.5GB ram. If I had to recover a multi-GB OST file, I would run the process on a dedicated machine and expect it to take a couple of days.

One other anomaly: When I opened the recovered PST file in Outlook, all the email items showed the date of the recovery operation in their Received field instead of the original Received date. Configuring Outlook to show the Sent field was an adequate workaround for my non-forensic purposes - the Sent field dates were good.

Update: The developer says the slow processing I experienced was likely due to my AV scanning each recovered item. And possibly also due to my desktop search utility (X1) that was also scanning in realtime. And he confirms that you cannot save to PST unless you have Outlook installed. I received his response just six hours after emailing my questions, which is a very nice level of support.

Safely Removing SATA and USB drives with a batch file

The devcon utility from Microsoft Downloads is what does it, but it's had me baffled for years. So now I've finally figured it out.

First we have to identify our removable device. The drive we're looking for is a 120GB Seagate drive in a USB enclosure . From the command line run

devcon classes



We can make a pretty good guess that our hard drive is going to fall within the class named "DiskDrive."

Now run the command

devcon listclass diskdrive



This lists all the Device Instance IDs in the DiskDrive class. At the bottom of the list are two USB Device Instance IDs. The bottom one is clearly the USB enclosure with our Seagate drive.

So here's our command:

devcon remove @usbstor\disk^&ven_st312002*

• We need the "@" symbol at the beginning of the Device Instance ID string to let devcon know that the string is in fact a Device Instance ID.
  
  
• We need to insert the "^" symbol preceding any occurrence of the "&" symbol; otherwise the string immediately following the "&" will be interpreted as a separate command.
  
  
• We need to truncate the Device Instance ID string and add the "*" wildcard at the end of it rather than using the whole Device Instance ID string because we want the command to work with any of our USB enclosures containing Seagate 120GB drives that we're swapping in for backups.

Now let's run the command.



Did it work? Let's do the devcon listclass diskdrive command again.



The USB enclosure with our 120GB Seagate drive is gone.

What if we need to re-connect this USB drive without trucking out to the customer site? Just run devcon rescan and then run devcon listclass diskdrive to confirm.

Updating Firefox while logged on as LUA

I do most of my work while logged in on a limited user account (LUA). When the Firefox updates automatically download, I can't install them as LUA. And if I try logging in as admin or using runas, Firefox doesn't know there's a download waiting for install. That's because the automatically-downloaded updates are profile-specific. So Google turned out to be my friend.

In a thread on this subject at
http://flimflan.com/blog/FirefoxErrorResolvedOneOrMoreFilesCouldNotBeUpdated.aspx
is a posting from a way-too-anonymous chap named Justin whom I have taken the liberty of directly quoting in red below:
----------------------
In the command line of the limited user, paste and execute the following line:

runas /user:Administrator /noprofile /env "C:\Program Files\Mozilla Firefox\firefox.exe"

The "/noprofile" and "/env" flags will launch Firefox with administrator permissions but without loading the Administrator's profile and will continue to use the current environment. Firefox will then update as necessary and open a browser window. Firefox can then be restarted with the limited user's permissions and will cease to complain.
-----------------------
Thanks, Justin!

Backup to USB: Batch file to email DIR list of backup target folder

I run this bat file after a backup to file on a USB drive. It emails me the bkf file names, sizes, and times along with the volume name of the USB drive. This answers two questions which are always at the back of my mind when I'm reviewing backup logs:

1. Is last night's backup significantly different in size or completion time than the historic trend for this customer?
   
2. Did the customer's designated Drive Swapping Person remember to do the drive swap?

Note that there are some long command lines in the bat file which will be wrapped on this webpage and require some manual repair before the bat file is usable. To make this a little easier to figure out, all the comments are green. Each command is followed by a blank line.
-----------------------------------------------------------------------------------
:: Email Directory List of Backup Target Folder at Completion of Backup


:: This bat file will email the contents of a text file as the message body, along
:: with designated attachments. It uses the free Blat commandline mailer,
:: downloadable from www.blat.net. Copy blat.exe to %windir%\system32 or some
:: other place in the path.

:: Do NOT use ampersand in the string for any set statement.


:: Get a dir list of the target folder, including the volume name.
:: Target folder may be either mapped to drive letter or an UNC path.

:: Set Dir List Parameters Here

SET TARGET_FOLDER=\\wrkstn23\Nightly_Backup

SET DIR_OUTPUT=c:\Program Files\BackupAssist\TargetFolderDirList.txt

dir "%TARGET_FOLDER%" > "%DIR_OUTPUT%"


:: Set Email Parameters Here
::

SET CUSTOMER_NAME=Test Customer

SET MESSAGE_BODY=%DIR_OUTPUT%

SET SEND_LOGS_TO=joe@domain.com,jane@domain2.com

SET EMAIL_SUBJECT=%CUSTOMER_NAME% - Backup Volume and File List

:: Name or IP address for SMTP_SERVER.
SET SMTP_SERVER=smtp.someserver.com

:: SENDER_ADDRESS may need to be one known by server
SET SENDER_ADDRESS=BackupAssist@testcustomer.com

SET SEND_ATTEMPTS=10

SET AUTH_IF_NEEDED=

:: SET AUTH_IF_NEEDED=-u UserName -pw PassWord
:: Leave AUTH_IF_NEEDED blank if no authentication required
:: There are additional switches available for authentication by
:: various means. See www.blat.net.

:: Files below are sent as attachments.

:: SET BINARY_FILES="C:\Temp\pic1.bmp","C:\Temp\pic2.bmp"

:: SET TEXT_FILES="C:\WINDOWS\pfirewall.log","C:\WINDOWS\system.ini"

::
::***********************************************************************************


:: Send backup log to various recipients.
:: Note that the debug switch will make
:: the blat logfile grow quickly.
:: If the -attach or -attacht switches are in the
:: command line AND the corresponding
:: variable(s) is not set, blat will fail. Four
:: sample commands are shown below, with
:: differences noted.

:: The following command creates a blat log with timestamps but no debug info.

:: blat "%MESSAGE_BODY%" -to %SEND_LOGS_TO% -subject "%EMAIL_SUBJECT%" -log blat1.log -timestamp -serverSMTP %SMTP_SERVER% %AUTH_IF_NEEDED% -try %SEND_ATTEMPTS% -f %SENDER_ADDRESS% -attach %BINARY_FILEs% -attacht %TEXT_FILES%

:: The following command creates a blat log with timestamps and debug info.

:: blat "%MESSAGE_BODY%" -to %SEND_LOGS_TO% -subject "%EMAIL_SUBJECT%" -log blat2.log -debug -timestamp -serverSMTP %SMTP_SERVER% %AUTH_IF_NEEDED% -try %SEND_ATTEMPTS% -f %SENDER_ADDRESS% -attach %BINARY_FILEs% -attacht %TEXT_FILES%

:: The following command creates a blat log with timestamp, no debug info, and
:: does not send any attachments.

::blat "%MESSAGE_BODY%" -to %SEND_LOGS_TO% -subject "%EMAIL_SUBJECT%" -log blat2.log -timestamp -serverSMTP %SMTP_SERVER% %AUTH_IF_NEEDED% -try %SEND_ATTEMPTS% -f %SENDER_ADDRESS%

:: The following command creates a blat log with timestamp and debug info, and
:: does not send any attachments.

blat "%MESSAGE_BODY%" -to %SEND_LOGS_TO% -subject "%EMAIL_SUBJECT%" -log blat2.log -debug -timestamp -serverSMTP %SMTP_SERVER% %AUTH_IF_NEEDED% -try %SEND_ATTEMPTS% -f %SENDER_ADDRESS%